CVE-2021-43528

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird < 91.4.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Dec 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-435299.8Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunde CVE-2021-43535.3The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and i CVE-2021-435306.1A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a Q CVE-2021-435314.3When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Ex CVE-2021-435326.1The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authenticatio CVE-2021-435334.3When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies t CVE-2021-435348.8Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed e CVE-2021-435358.8A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a pote CVE-2021-435366.5Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability aff CVE-2021-435378.8An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitabl CVE-2021-435384.3By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full scre CVE-2021-435398.8Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing